Block based backup applications bypass the file system and read data directly at the volume level. The advantage of reading data at block level is that, there is no penalty on backup performance when the volume has large number of files. Block based incremental backup is a type of incremental backup, where only those blocks are backed up that have changed since the previous incremental backup. The most efficient method for computing incremental backups at the volume level is by using a volume class filter driver. This filter driver is situated between the file system and the disk class driver. By placing a volume filter between the file system and disk subsystem, the driver is able to identify changed volume blocks in real-time. In Windows, this kind of device driver is called an upper volume device filter driver. As writes are monitored at volume level, the block that was changed is recorded in an in-memory data structure inside the kernel that details the on-volume location of the block which was changed as a result of the incoming write. Three major challenges with the process of implementing and using a filter driver to maintain changed block tracking are: (1) This approach requires the target system to be rebooted for the filter driver to successfully attach to boot volume of the system and this in turn means downtime for a production server which could be hosting mission critical applications and workloads. (2) Some third party volume filter driver can be introduced below our volume filter and could potentially issue writes to the volume. This would interfere with the write interception logic in the upper volume device filter driver. On similar lines a user mode application might directly open a device handle to the underlying disk device and initiate sector level writes. Such IO is directly sent to the disk class driver thereby completely bypassing the volume stack. (3) Cluster shared volumes (CSV) on Windows 8 introduces additional complexities for block level incremental backups by exposing a shared disk containing an NTFS volume that is made accessible for read and write operations by all nodes within a Windows Server Failover Cluster. On non-coordinator CSV nodes there is no concept of volume stack as writes go directly from the CSV file system minifilter driver to disk class driver. A volume class filter cannot be used for tracking all the changed blocks across various nodes.